ci: hash-pin pip deps + pin wasmtime (Scorecard Pinned-Dependencies)

[Fieldnote-Echo]

Clears the hashable OpenSSF Scorecard Pinned-Dependencies alerts (#1–#4, #6).

• wasmtime (chore: cargo fmt + clippy -D warnings clean + regenerate Cargo.lock #1 — the genuine one): replace curl | bash of the unpinned install script in the wasm job with a pinned release download (v45.0.0) + sha256sum -c verification.
• pip test/tool deps (docs: de-fiction extracted crate + dual MIT/Apache license #2, chore(ci): production release gate (CI matrix, SDE AVX-512, deny, MSRV) #3, test: cargo-fuzz loader targets + SignBitmap malformed-loader coverage #4, fuzz: drive loader targets in-memory to avoid per-iteration temp files #6): hash-pin pytest/numpy/maturin (ordvec-python/requirements-dev.txt, generated by uv pip compile --universal --generate-hashes --python-version 3.9 so one file covers the 3.9–3.13 × OS matrix via environment markers) and zizmor (.github/zizmor-requirements.txt); installed with pip install --require-hashes -r … in python.yml, release-python.yml, and zizmor.yml.

#5 (pip install dist/*.tar.gz) installs the freshly-built local sdist — no stable hash by design — so it's dismissed in code scanning rather than fixed.

Verified locally: zizmor --offline clean, actionlint clean (incl. shellcheck on the new wasmtime step), YAML valid. Requirements files are Dependabot-maintained.

[qodo-code-review]

Review Summary by Qodo

Pin pip and wasmtime dependencies for supply chain security

✨ Enhancement 🐞 Bug fix

Walkthroughs

Description

• Replace unpinned wasmtime install script with pinned v45.0.0 release + SHA256 verification
• Hash-pin pytest, numpy, maturin dependencies via requirements-dev.txt file
• Hash-pin zizmor workflow audit tool via dedicated requirements file
• Update CI workflows to use pip install --require-hashes for dependency verification

Diagram

flowchart LR
  A["Unpinned Dependencies"] -->|"Replace curl bash"| B["Pinned wasmtime v45.0.0"]
  A -->|"Hash-pin via uv"| C["requirements-dev.txt"]
  A -->|"Hash-pin via uv"| D["zizmor-requirements.txt"]
  B -->|"SHA256 verification"| E["Supply Chain Security"]
  C -->|"pip --require-hashes"| E
  D -->|"pip --require-hashes"| E

Loading

File Changes

1. .github/workflows/ci.yml Security enhancement +10/-2

Pin wasmtime release with SHA256 verification

• Replace curl | bash wasmtime install with pinned v45.0.0 release download
• Add environment variables for wasmtime version and SHA256 hash
• Implement SHA256 checksum verification before extraction
• Extract tarball and add to PATH instead of using install script

.github/workflows/ci.yml

---

2. .github/workflows/python.yml Security enhancement +1/-1

Use hash-pinned requirements for Python dependencies

• Replace inline pip install with hash-pinned requirements file
• Change from pip install --upgrade pip maturin numpy pytest to `pip install --require-hashes -r
 ordvec-python/requirements-dev.txt`
• Apply to both wheel and sdist test jobs

.github/workflows/python.yml

---

3. .github/workflows/release-python.yml Security enhancement +2/-2

Use hash-pinned requirements for release Python tests

• Replace inline pip install with hash-pinned requirements file in wheel test job
• Replace inline pip install with hash-pinned requirements file in sdist test job
• Change from pip install --upgrade pip pytest numpy to `pip install --require-hashes -r
 ordvec-python/requirements-dev.txt`

.github/workflows/release-python.yml

---

View more (3)

4. .github/workflows/zizmor.yml Security enhancement +1/-1

Use hash-pinned requirements for zizmor tool

• Replace inline zizmor version pin with hash-pinned requirements file
• Change from pip install zizmor==1.25.2 to `pip install --require-hashes -r
 .github/zizmor-requirements.txt`
• Enable pip hash verification for workflow security audit tool

.github/workflows/zizmor.yml

---

5. .github/zizmor-requirements.txt Dependencies +19/-0

Hash-pinned zizmor requirements file

• New file containing hash-pinned zizmor==1.25.2 with 8 SHA256 hashes
• Generated via uv pip compile --generate-hashes --python-version 3.13
• Includes metadata comments about generation and installation method
• Maintained by Dependabot for automated updates

.github/zizmor-requirements.txt

---

6. ordvec-python/requirements-dev.txt Dependencies +292/-0

Hash-pinned development and test dependencies

• New file with 292 lines of hash-pinned development dependencies
• Includes pytest, numpy, maturin and transitive dependencies with SHA256 hashes
• Generated via uv pip compile --universal --generate-hashes --python-version 3.9
• Covers Python 3.9-3.13 matrix via environment markers
• Maintained by Dependabot for automated updates

ordvec-python/requirements-dev.txt

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Wasmtime arch hardcoded ✓ Resolved 🐞 Bug ☼ Reliability

Description

The wasm CI job now downloads the x86_64 Linux wasmtime tarball unconditionally, so the job will
fail if the runner is ever switched to an ARM Ubuntu runner. This is a portability regression
compared to the prior installer script approach.

Code

.github/workflows/ci.yml[R326-330]

Evidence

The wasm job runs on ubuntu-latest but the download/extract path is hard-coded to x86_64-linux,
and the same workflow already runs an ARM Ubuntu runner in another job—showing ARM runners are part
of this repo’s CI footprint.

.github/workflows/ci.yml[303-306]
.github/workflows/ci.yml[325-330]
.github/workflows/ci.yml[354-361]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The `wasm` job installs wasmtime by downloading `wasmtime-${WASMTIME_VERSION}-x86_64-linux.tar.xz` and adding `...-x86_64-linux` to `GITHUB_PATH`. This hard-codes the architecture and will break if the job is ever run on an ARM runner.

### Issue Context
This workflow already uses ARM runners (`ubuntu-24.04-arm`) in other jobs, making an eventual runner/arch adjustment plausible.

### Fix Focus Areas
- .github/workflows/ci.yml[325-330]

### Suggested fix
- Compute the asset suffix from `${{ runner.arch }}` / `${{ runner.os }}` (or `uname -m`) and map it to wasmtime’s release naming (e.g., `x86_64-linux`, `aarch64-linux`).
- Use the computed suffix both for the `tarball=...` name and the directory appended to `GITHUB_PATH`.
- If you want to keep the job strictly x86_64, add an explicit guard that fails with a clear error message when the runner arch is not x64.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[gemini-code-assist]

Code Review

This pull request adds two new requirements files containing hash-pinned dependencies to satisfy OpenSSF Scorecard Pinned-Dependencies checks. Specifically, it introduces .github/zizmor-requirements.txt for the zizmor workflow-audit CI job and ordvec-python/requirements-dev.txt for the ordvec-python development and testing environment. There are no review comments, and I have no feedback to provide.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!